FW: bugbear virus

hi all.

i got this in my inbox the other morning, and while the bugbear virus isn't new,
the text which came with it is to me...

-----Original Message-----
From: Tronick [mailto:tronick@gci.com]
Sent: None
Subject: Re: [HackIndex] [OT]Servidor DNS!

    Efectivamente el router hace NAT, y ya puse dicha opcion, 'query-source address * port 53' y sigue sin rular. Todos los ejemplos que he visto por ahi son para la version 8.X, y el caso es que a mi no me rulan, y no se, sis por una mala configuracion (al arrancar el servicio, y los logs, no me dan error alguno), o por que simplemente el proveedor (ADSL con Telefonica) no

...here's the translation according to altavista from spanish to english...

Indeed router NAT ago, and already I put this option, ' query-source address * port 53 ' and follows without rular. All the examples that I have seen by ahi are for the version 8.X, and the case is that to my they do not rulan to me, and not, sis by a bad configuration (when starting the service, and logs, do not give to error some me), or so that simply the supplier (ADSL with Telefonica) no

...can anyone make some sense of this? our firewall is running DNS on the traditional port 53 and it is also running NAT, so i'm a little concerned about this conicidence.

and for completeness, here's the headers...

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Received: from igmp.com.ar (200.49.105.124 [200.49.105.124]) by stork.webwaresi with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2656.59)

        id WGHHKD6Y; Wed, 20 Nov 2002 19:39:59 -0800 Received: (qmail 20423 invoked from network); 21 Nov 2002 03:26:00 -0000 Received: from unknown (HELO home) (200.41.33.148)   by 0 with SMTP; 21 Nov 2002 03:26:00 -0000 From: "Tronick" <tronick@gci.com>

Subject:  Re: [HackIndex] [OT]Servidor DNS!
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------TA5RHG31WRSWAK"

------------TA5RHG31WRSWAK

Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit

------------TA5RHG31WRSWAK

Content-Type: application/x-msdownload; name="servidor de WWW.NETSYSTEM.COM.AR.scr"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="servidor de WWW.NETSYSTEM.COM.AR.scr"

------------TA5RHG31WRSWAK--
Received on Tue Nov 26 11:59:10 2002